Documentation
¶
Overview ¶
Package awsmeta defines the Metadata struct that carries AWS request-scoped identity (account, region, partition, request ID) and a helper to populate it from an *http.Request.
Storage on context.Context is delegated to pkgs/ctxval — this package exposes a single Key plus thin Set/Get/Region/Account wrappers so service backends pull metadata uniformly without each one defining its own key.
Index ¶
- Constants
- Variables
- func AccessKeyID(ctx context.Context) string
- func Account(ctx context.Context) string
- func CallerArn(ctx context.Context) string
- func Partition(ctx context.Context) string
- func Region(ctx context.Context) string
- func Service(ctx context.Context) string
- func Set(ctx context.Context, m *Metadata) context.Context
- func UserID(ctx context.Context) string
- func UserName(ctx context.Context) string
- type Metadata
- type Principal
- type PrincipalKind
- type PrincipalResolver
- type PrincipalResolverChain
Constants ¶
const DefaultAccount = "000000000000"
DefaultAccount is the gopherstack default 12-digit account ID.
const DefaultPartition = "aws"
DefaultPartition is the public AWS commercial partition.
Variables ¶
var Key = ctxval.NewKey[*Metadata]("awsmeta") //nolint:gochecknoglobals // existing issue.
Key is the context key under which Metadata is stored. Exported so callers that want raw ctxval access (e.g. middleware that wraps Set with logging) can reuse it.
Functions ¶
func AccessKeyID ¶ added in v1.3.1
AccessKeyID returns Get(ctx).AccessKeyID.
Types ¶
type Metadata ¶
type Metadata struct {
// Principal is the resolved IAM/STS identity of the caller.
Principal *Principal
// Account is the 12-digit AWS account ID.
Account string
// Region is the AWS region (e.g. "us-east-1"). Empty for global services.
Region string
// Partition is the AWS partition (aws, aws-cn, aws-us-gov).
Partition string
// RequestID is the X-Amz-Request-Id correlation value.
RequestID string
// AccessKeyID is the AWS access key ID extracted from the SigV4 credential scope.
AccessKeyID string
// SecurityToken is the session token extracted from X-Amz-Security-Token.
SecurityToken string
// Service is the AWS service name extracted from the SigV4 credential scope.
Service string
}
Metadata carries AWS request-scoped identity and routing fields.
func FromRequest ¶
FromRequest builds a Metadata from r. defaultRegion is applied when no region is derivable from the SigV4 scope. Always returns non-nil with Account and Partition populated.
type Principal ¶
type Principal struct {
Kind PrincipalKind `json:"kind"`
Arn string `json:"arn"`
UserName string `json:"userName,omitempty"`
AccountID string `json:"accountID"`
SessionName string `json:"sessionName,omitempty"`
UserID string `json:"userID,omitempty"`
SourceIdentity string `json:"sourceIdentity,omitempty"`
}
Principal represents the resolved AWS identity of the caller.
func GetPrincipal ¶
GetPrincipal returns the Principal associated with ctx, or nil if unauthenticated/unresolved.
type PrincipalKind ¶
type PrincipalKind string
PrincipalKind describes the type of AWS principal making a request.
const ( // PrincipalKindUser represents an IAM user principal. PrincipalKindUser PrincipalKind = "User" // PrincipalKindAssumedRole represents an STS assumed-role session principal. PrincipalKindAssumedRole PrincipalKind = "AssumedRole" // PrincipalKindRole represents an IAM role principal. PrincipalKindRole PrincipalKind = "Role" // PrincipalKindRoot represents the AWS account root user principal. PrincipalKindRoot PrincipalKind = "Root" // PrincipalKindAnonymous represents an unauthenticated/anonymous caller. PrincipalKindAnonymous PrincipalKind = "Anonymous" )
type PrincipalResolver ¶
type PrincipalResolver interface {
ResolvePrincipal(ctx context.Context, accessKeyID, sessionToken string) (*Principal, bool)
}
PrincipalResolver resolves an access key (and optional session token) to an AWS principal.
type PrincipalResolverChain ¶
type PrincipalResolverChain []PrincipalResolver
PrincipalResolverChain is a slice of PrincipalResolvers evaluated in order.
func (PrincipalResolverChain) ResolvePrincipal ¶
func (c PrincipalResolverChain) ResolvePrincipal( ctx context.Context, accessKeyID, sessionToken string, ) (*Principal, bool)
ResolvePrincipal evaluates each resolver in the chain until one returns a principal.
Source Files